Graph-Anchored Auditing Protocol

• Graph-Anchored Auditing Protocol is a design where audit actions, evidence, and verdicts are tied to explicit graph structures rather than heuristic or textual methods.
• It integrates deterministic symbolic checks, cryptographic attestations, and statistical tests to achieve high accuracy in verifying financial reports, smart contracts, and distributed systems.
• The protocol transforms audit verdicts into formal statements about graph relationships, enhancing transparency and reliability in diverse application domains.

Searching arXiv for the cited works to ground the article in current papers. A graph-anchored auditing protocol is an auditing design in which audit actions, evidence, and verdicts are grounded in explicit graph structure rather than in free-form textual reasoning or repository-local heuristics. In current research, this pattern appears in structured financial reporting verification, cross-chain smart contract security, privacy auditing of multi-tenant retrieval-augmented generation, specification-anchored auditing of distributed protocols, graph-based audits of algorithmic elections, verification of graph states in an untrusted network, Rust dependency auditing, and global auditing of graph neural networks (Wang et al., 2 Jun 2026, Feng et al., 27 Apr 2026, Burnat et al., 19 May 2026, Kamba et al., 29 Apr 2026, Heitzmann, 4 Feb 2026, Unnikrishnan et al., 2020, Zoghbi et al., 6 Feb 2026, Sahoo et al., 5 May 2026). Across these settings, the graph may encode regulatory relations, call and data flow, cryptographic commitments, state-space transitions, stabilizer structure, crate dependencies, or learned embedding geometry; the audit then constrains reasoning to traversals, measurements, or proofs over that graph.

1. Conceptual basis

Graph anchoring emerges when correctness depends on structured relations rather than on surface text. In structured financial reporting verification, correctness depends on structured evidence rather than text alone: a model must link reported facts to taxonomy concepts, traverse calculation or dimensional relations, and recompute expected values before applying an audit rule (Wang et al., 2 Jun 2026). In multi-implementation protocol auditing, code-driven auditing fails when correctness depends on what the specification requires rather than how the code is written (Kamba et al., 29 Apr 2026). In cross-chain smart contract auditing, GoAT-X shifts automated cross-chain smart contract codebases auditing from heuristic pattern matching toward systematic first-principles verification, and constrains semantic reasoning within well-defined structural and state boundaries (Feng et al., 27 Apr 2026). In election auditing, a generalized RLA framework has remained elusive for algorithmic election rules such as the Single Transferable Vote rule, because of the dependence of these rules on the chronology of eliminations and elections leading to the outcome of the election; the graph-based response is to consider the space of all possible sequences of elections and eliminations and verify statistically that the true election sequence does not leave a fixed subgraph (Heitzmann, 4 Feb 2026).

The shared idea is that the graph is not merely contextual retrieval. It is the object that defines admissible states, relevant evidence, permissible transitions, and the semantics of a valid check. This suggests a graph-anchored auditing protocol is characterized less by a particular application domain than by a recurring separation: probabilistic or semantic reasoning may choose what to inspect, but correctness is tied to graph-grounded constraints, graph-referenced evidence, or graph-defined transition systems.

A second common feature is that graph anchoring changes the meaning of an audit verdict. A verdict is no longer a narrative assessment alone. It becomes a statement that specific graph relations hold, that particular boundary edges cannot occur, that a stabilizer family has passed, that top-$K$ retrieval was computed over the committed tenant index, or that a path from a public API to a dangerous effect has been classified and propagated. In this sense, graph anchoring converts auditing from unstructured inspection into constrained verification over an explicit relational substrate.

2. Graph substrates and audit state

The graph substrate varies by domain, but the architectural pattern is stable. AuditFlow represents the audit environment as a dual graph,

$$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$

where $\mathcal{G}_T^y$ is a static US-GAAP taxonomy graph, $\mathcal{G}_F$ is a dynamic filing graph built from the target XBRL filing, $\mathcal{A}$ is a set of typed actions, and $O(a,s)$ is a deterministic observation function; bridge edges link filing facts to taxonomy concepts (Wang et al., 2 Jun 2026). GoAT-X builds several graph-like artifacts: a Function Call Graph, a Taint / Data-Flow Graph, a conceptual Cross-Chain Transaction Graph, and a Graph of Auditing Thoughts $G=(S,E)$, where each state is a sequence of atomic auditing thoughts and edges connect reasoning states across extraction, mapping, slicing, predicate checking, and bypass analysis (Feng et al., 27 Apr 2026).

In privacy auditing for multi-tenant RAG, the graph is explicitly cryptographic. The protocol builds a graph or DAG of cryptographically committed entities: tenants, indexes and their vector commitments, accounts, query records in an append-only Merkle ledger, noise samples derived from a committed seed, top-$K$ outputs, policy commitments, and coalition-estimator artifacts. Edges correspond to cryptographic attestations, including Merkle inclusion, vector-commitment openings, and zero-knowledge proofs linking queries to tenant-local indexes and to the noise-then-select mechanism (Burnat et al., 19 May 2026). In graph-based audits for Meek STV elections, the universal audit graph $\Omega$ is a directed layered graph whose vertices are election states $(H,W)$ and whose edges represent single-step transitions in which one candidate is elected or eliminated; the audit is then anchored to a coherent subgraph $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$0 (Heitzmann, 4 Feb 2026).

Specification-anchored auditing of distributed protocols uses a multi-layer property graph. SPECA decomposes specifications into subgraphs annotated with invariants, derives typed properties such as invariants, preconditions, postconditions, and trust assumptions, and maps them to implementation code entities through a subgraph index. Findings are then traceable along paths of the form spec section $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$1 subgraph $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$2 property $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$3 code region $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$4 failed proof $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$5 attack path (Kamba et al., 29 Apr 2026). Cargo Scan, in turn, relies on the crate dependency graph, the call graph within a crate, and higher-order or trait “virtual” edges; functions are decorated with effect sets, and public caller-checked functions become graph-visible obligations that propagate across crate boundaries (Zoghbi et al., 6 Feb 2026).

Two further variants extend the pattern. In graph-state verification, the adjacency structure of a graph $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$6 determines stabilizer generators

$$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$7

and the stabilizer group becomes the graph anchor against which the untrusted source and dishonest parties are tested (Unnikrishnan et al., 2020). In GRAFT, the graph substrate is the trained GNN itself: node embeddings produced by message passing define the geometry used for farthest-point exemplar selection, and Integrated Gradients are computed with the graph held fixed, so global feature attributions remain graph-conditioned (Sahoo et al., 5 May 2026).

These instances suggest several recurring graph types: static regulatory graphs, dynamic case graphs, code graphs, property graphs, commitment DAGs, state-space graphs, stabilizer graphs, and learned embedding graphs. What changes is the semantics attached to nodes and edges; what remains constant is that the audit state is represented as traversal over, or commitment to, graph structure.

3. Executable operators and protocol control

Graph anchoring becomes operational only when the graph is made executable. AuditFlow exposes its dual graph through a typed action-observation interface. Static taxonomy tools include lookup_concept_spec, walk_calc_tree, list_dim_axes, find_dqc_rules, and get_fact; deterministic rule-check tools include check_sign, check_calc_tree, and check_dim_consistency; dynamic filing tools include get_fact_history, compare_periods, detect_temporal_outlier, get_dimensional_breakdown, check_unit_decimal_consistency, and related operators (Wang et al., 2 Jun 2026). The protocol uses two junior auditors and a senior auditor. The juniors operate in ReAct-style loops, while a required-tools gate forces symbolic engagement before a report can be finalized: one junior must call check_sign, check_calc_tree, and check_dim_consistency, and the other must call get_fact_history in addition to the same three checkers (Wang et al., 2 Jun 2026).

GoAT-X uses a different control logic but the same principle of constrained graph execution. Its auditing process is modeled by $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$8 with operations $$\mathcal{E} = \big(\mathcal{G}_T^y, \mathcal{G}_F, \mathcal{A}, O\big),$$9: static-analysis-based expansion, LLM-based thought generation, aggregation, and evaluation. The workflow is layered: code ingestion and static analysis build transaction graphs; property mapping links abstract predicates to code variables; data-flow slicing extracts focused code fragments; predicate coverage checks locate implementations of Integrity, Authenticity, and Safety predicates; and bypass analysis explores adversarial paths with state context and retrieved exploit principles. Outputs are validated against JSON schema, required fields, and code-range consistency, and invalid outputs trigger self-correction prompts (Feng et al., 27 Apr 2026).

SPECA similarly organizes audit control as a pipeline. Specification discovery, subgraph extraction, and property generation are run once per specification corpus; code pre-resolution, property-grounded proof attempts, and severity-preserving review run per implementation. Phase 5 explicitly decomposes each property assertion into sub-claims, maps each sub-claim to code, attempts a proof, records a gap if the proof fails, and stress-tests that gap for a plausible attack path (Kamba et al., 29 Apr 2026). Cargo Scan makes the human auditor part of the execution model: effect instances discovered on the AST and call graph are marked safe, unsafe, or caller-checked; default audits conservatively mark every effect as caller-checked and propagate them up the stack, while manual auditing refines those graph annotations over time (Zoghbi et al., 6 Feb 2026).

In the quantum-network setting, executability takes the form of local stabilizer measurements and classical communication. An honest Verifier protocol randomly selects copies, chooses stabilizers from a test set, instructs local $\mathcal{G}_T^y$0, $\mathcal{G}_T^y$1, or $\mathcal{G}_T^y$2 measurements, multiplies the reported outcomes, and accepts or aborts based on the total number of passed tests; a symmetric protocol replaces the trusted Verifier with a trusted common random source that randomizes sample sets and verifier identities (Unnikrishnan et al., 2020). Despite the difference in surface form, the same pattern holds: the graph anchor determines the legal measurements, and the protocol defines when enough graph-grounded evidence has been accumulated.

4. Decision semantics, evidence, and guarantees

Graph-anchored audits differ most sharply in how they convert graph-grounded evidence into a formal decision. AuditFlow’s final reports are fused through Evidential Reasoning to produce an audit verdict, expected value, evidence trail, and trustworthiness score. The final binary decision is based on mass functions over $\mathcal{G}_T^y$3, normalized fusion, and a trustworthiness score

$\mathcal{G}_T^y$4

so the final explanation is grounded both in tool traces $\mathcal{G}_T^y$5 and in an evidence set $\mathcal{G}_T^y$6 that references specific fact nodes, taxonomy concepts, and outputs of check_* tools (Wang et al., 2 Jun 2026).

Privacy auditing in multi-tenant RAG adopts a cryptographic and differential-privacy decision semantics. The protocol is designed to issue a quantitative

$\mathcal{G}_T^y$7

verdict for the retrieval-score channel without index disclosure, pipeline redesign, or model-weight exposure. Same-index multi-account collusion degrades joint leakage at rate $\mathcal{G}_T^y$8 for Gaussian-noised retrieval; cross-tenant and external collusion match the rate only under explicit access-control failure (M4), and without M4 these regimes have zero leakage by design and reduce to an architectural audit, not a DP audit (Burnat et al., 19 May 2026). This directly distinguishes graph-anchored privacy auditing from a purely statistical privacy claim: the graph of commitments and containment proofs determines whether the relevant leakage channel exists at all.

For Meek STV, the decision rule is statistical and boundary-based. Once a coherent subgraph $\mathcal{G}_T^y$9 is fixed, the global null $\mathcal{G}_F$0 is that the true election path leaves $\mathcal{G}_F$1. For each boundary edge $\mathcal{G}_F$2, a local null $\mathcal{G}_F$3 asserts that the true next state exits through that edge. The key proposition states that if each $\mathcal{G}_F$4 has an $\mathcal{G}_F$5-level rejection rule $\mathcal{G}_F$6, then

$\mathcal{G}_F$7

is a valid $\mathcal{G}_F$8-level test for $\mathcal{G}_F$9 (Heitzmann, 4 Feb 2026). The audit therefore does not need to certify an exact chronology; it needs only to rule out all departures from the fixed graph.

In graph-state verification, the guarantee is a fidelity statement on the honest reduced state of the target copy. The only state that can pass all stabilizer tests perfectly in each round is $\mathcal{A}$0, where $\mathcal{A}$1 acts only on the dishonest subsystem; Serfling-based analysis then yields lower bounds on the fidelity $\mathcal{A}$2 as a function of the number of passed tests (Unnikrishnan et al., 2020). The guarantee is thus neither a heuristic confidence score nor a semantic explanation; it is a graph-state fidelity bound tied to the stabilizer structure.

A recurring misconception is that graph structure alone is sufficient. AuditFlow explicitly reports that GraphRAG and TreeRAG, which provide structured retrieval but no executable checks, reach 43–48% Joint ACC, while removing deterministic checks drops Joint ACC from 82.09% to 17.91%; the paper states that graph structure alone is not enough and that the executable symbolic checks are the load-bearing component (Wang et al., 2 Jun 2026). This suggests that graph anchoring is best understood as graph-constrained verification, not graph-flavored retrieval.

5. Representative instantiations

Domain	Graph anchor	Characteristic result
Structured financial reporting	Static US-GAAP taxonomy graph + dynamic XBRL filing graph	82.09% Joint ACC under GPT-5.5; 17.91% without deterministic checks
Cross-chain smart contracts	Function call graph, taint/data-flow graph, Graph of Auditing Thoughts	92% recall on fine-grained audit points; 95% coverage of vulnerable projects
Multi-tenant RAG privacy	Merkle ledgers, vector commitments, ZK-linked retrieval DAG	Quantitative $\mathcal{A}$3 verdict for the retrieval-score channel
Multi-implementation distributed protocols	Spec subgraphs, typed property graph, code mappings	All 15 in-scope H/M/L vulnerabilities recovered expert-augmented; 88.9% precision at 100% recall on RepoAudit C/C++
Rust crates	Dependency graph and call graph with effect annotations	Auditing burden reduced to a median of 0.2% of lines of code; $\mathcal{A}$4K of the top 10K crates automatically classified as safe
Meek STV elections	Universal audit graph $\mathcal{A}$5 and coherent subgraph $\mathcal{A}$6	About 76.6% of 881 Scottish local elections auditable with ASN $\mathcal{A}$7 at $\mathcal{A}$8
Graph states in an untrusted network	Stabilizer graph defined by adjacency	Generator tests give global efficiency for complete, pentagon, cycle, 1D cluster, and 2D cluster graph states

AuditFlow reaches 82.09% joint audit accuracy under GPT-5.5 on a FinAuditing-derived FinMR sample and outperforms the strongest baseline by 14.93 points; removing deterministic checks drops accuracy to 17.91%, and invalid outputs rise to 35.82% (Wang et al., 2 Jun 2026). GoAT-X achieves 92% recall on fine-grained audit points and 95% coverage of vulnerable projects, and identifies 117 confirmed risks in the wild with low operational cost (Feng et al., 27 Apr 2026). SPECA recovers all 15 in-scope H/M/L vulnerabilities expert-augmented, recovers 8/15 automated-only, surfaces 4 fix-confirmed bugs, and on the RepoAudit C/C++ benchmark reaches 88.9% precision at 100% recall with $\mathcal{A}$9 (Kamba et al., 29 Apr 2026). Cargo Scan’s experience auditing hyper and its dependencies shows that the auditing burden of potentially dangerous code can be reduced to a median of 0.2% of lines of code, while automatically classifying about 3.5K of the top 10K crates on crates.io as safe (Zoghbi et al., 6 Feb 2026). In GRAFT, global class-level feature profiles derived from FPS, Integrated Gradients, and aggregation are further rendered as concise natural-language rules, and structured human evaluation reports accuracy scores between 4.38 and 4.79 and actionability between 4.17 and 4.52 (Sahoo et al., 5 May 2026).

These examples show that graph-anchored auditing is not confined to one verification regime. Deterministic symbolic checking, cryptographic attestation, statistical hypothesis testing, stabilizer sampling, property-grounded proof attempts, and human-in-the-loop effect classification can all instantiate the same underlying architecture, provided that the audit state and audit obligations are explicitly represented as graph structure.

6. Limitations and open directions

The dominant limitation is that graph anchoring does not remove the need for correct, domain-specific execution semantics. AuditFlow is limited in scope to 67 cases and three DQC rule families and depends on filings and taxonomies being parseable into clean graphs; it does not deal with poorly tagged reports, PDFs, or semi-structured data, and weak LLMs can fail to follow the tool protocol and never reach deterministic checks (Wang et al., 2 Jun 2026). GoAT-X remains vulnerable to implicit semantics that are not explicit checks; the paper highlights the Allbridge slippage bug as an example, and also notes scalability costs, incomplete AST or call-graph extraction, and the absence of exhaustive symbolic execution (Feng et al., 27 Apr 2026). SPECA’s false positives trace to trust-boundary misunderstanding, code reading error, and specification misinterpretation, while a multi-model study identifies property-generation quality as the binding constraint (Kamba et al., 29 Apr 2026).

Graph anchoring can also inherit the scaling pathologies of the underlying graph. In graph-state verification, arbitrary graph states may require testing all $O(a,s)$0 stabilizers, producing exponential overhead in $O(a,s)$1; global efficiency is obtained only for particular graph families and specified dishonest configurations (Unnikrishnan et al., 2020). In Meek STV auditing, the main obstacle is the combinatorial “elimination cloud,” alongside degenerate and irregular states, degree limitations beyond two winners, and the difficulty of formally justified shortcuts through large candidate fields (Heitzmann, 4 Feb 2026). In multi-tenant RAG privacy, zero-knowledge proving cost can be heavy, full coverage at production scale may require more efficient proving systems or audit sampling, and the coalition-size estimator can be gamed by an adversary that deliberately diversifies queries enough to fall below similarity thresholds (Burnat et al., 19 May 2026).

A further limitation is that some graph-anchored audits cover only one slice of system behavior. The RAG protocol explicitly scopes out generation-channel privacy and audits only the retrieval-score channel (Burnat et al., 19 May 2026). GRAFT provides feature-level global explanations, but on heterophilic graphs where topology dominates predictions, feature-based fidelity is low; its zero baseline is natural for sparse BoW or TF-IDF features but less clear for dense continuous features (Sahoo et al., 5 May 2026). Cargo Scan focuses on dangerous effects rather than on full functional correctness, and its effect model does not attempt to cover every class of logical bug (Zoghbi et al., 6 Feb 2026).

Current extensions are correspondingly targeted. AuditFlow suggests expanding rule coverage, handling less structured sources, improving scalability, and strengthening contracts between agents and tools (Wang et al., 2 Jun 2026). GoAT-X points toward better semantic data-flow tracking, non-EVM extensions, and tighter coupling with symbolic execution or formal verification (Feng et al., 27 Apr 2026). SPECA suggests stronger graph-based treatment of cryptographic invariants and protocol lifecycle rules, while GRAFT suggests combining feature-level and structural global explainers into unified audit reports (Kamba et al., 29 Apr 2026, Sahoo et al., 5 May 2026). In election auditing, higher-degree Meek audits, graph-based audits for WIGM STV, and formal treatment of multi-candidate shortcuts remain open (Heitzmann, 4 Feb 2026).

Taken together, these directions suggest that the mature form of a graph-anchored auditing protocol is not just a graph-informed assistant. It is a layered system in which domain rules, case data, execution traces, and admissible claims are all tied to explicit nodes, edges, or boundary conditions, and in which the audit verdict is justified by graph-grounded computation, graph-grounded statistics, or graph-grounded cryptographic evidence.